
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Instantly update your own NPM modules src into your current working project, skipping publishing and updating it on every minimal change in npm sources.
Instantly update your own npm modules src into your current working project, skipping publishing and updating it on every minimal change in npm sources.
If you are an experienced npm package creator, you use your own npm modules intensively and update your modules often, you might have encountered a problem that every time you need to change in one of your own modules quickly - you need to publish it on every smallest change, to be able to use it in the project you are working on. It makes you reluctant making small changes.
In the ideal world, that would be great if every time you change a tiny thing in your npm project sources - something magically and automatically would update the same npm module to the npm_modules folder in the project you're currently working on...
And here it is!
just install this package in the project you are working on, create the config, where you list your own npm projects paths and "npmnpm" will watch all changes you make in your far npm module source folder and update it right away! No need to npm publish it every time you changes something.
Now that it's so easy, you will spend less time waiting and allow yourself experiment more with your own npm modules, since it can be done so effortlessly.
npm -i -D livee
Imagine your name is Tobias and you have a couple of your own npm modules you created, they are located at
home/tobias/my_npm/incredible_iconshome/tobias/my_npm/cool_mathand also you use them in your JS project at
home/games/tobi_pacman
Of course, his npm modules must be published at npmjs.com and then he should install them normally into tobi_pacman folder by doing npm i -S incredible_icons and npm i -S cool_math, they are added to package.json and traditionaly sit in Pacman's node_modules.
Now, in the middle of development of his pacman, Tobias discover that npm module cool_math has a bug in cool.lerp() function. It a small change from - to + in the code, but once he changed it, to use it in Pacman project, he needs to:
npm test in cool_math, waitnpm publishyou forgot to change the version numbertobi_pacman and run npm i -S cool_math@latestIsn't it crazy? Now, let's see how NOT to do this with the help of livee:
npm -i -D livee, once.livee.json file in the Pacman's root once{
"npmSrcRoots":[
"home/tobias/my_npm/"// a path to the root folder of npm sources of modules, created by me.
/// since all my node module sources are kept in the same folder - no need to list each of them.
],
// if I don't keep my "node_modules" in Pacman's root folder, I need to add
// a variable here:
"myNodeModulesRoot":"../"/// this means "my node_modules folder is one level above the project". The default value is "./" (same folder)
}
scripts section: ...
"watch-npm":"livee"
...
And now Tobias can start the npm watch-npm once, and he knows, that every time he makes even the smallest change in his cool_math sources - once he switches back to continue developing Pacman - the updated module is already there in node_modules.
Of course, if he performed enough changes in cool_math for bigger release - he will do the npm publish as usual. That's said - livee made the life of Tobias easier.
FAQs
Instantly update your own NPM modules src into your current working project, skipping publishing and updating it on every minimal change in npm sources.
We found that livee demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.